git.squeep.com Git - akkoma/blob - lib/pleroma/html.ex

   1 defmodule Pleroma.HTML do
   2   alias HtmlSanitizeEx.Scrubber
   3
   4   @markup Application.get_env(:pleroma, :markup)
   5
   6   def filter_tags(html) do
   7     scrubber = Keyword.get(@markup, :scrub_policy)
   8     html |> Scrubber.scrub(scrubber)
   9   end
  10
  11   def strip_tags(html) do
  12     html |> Scrubber.scrub(Scrubber.StripTags)
  13   end
  14 end
  15
  16 defmodule Pleroma.HTML.Scrubber.TwitterText do
  17   @moduledoc """
  18   An HTML scrubbing policy which limits to twitter-style text.  Only
  19   paragraphs, breaks and links are allowed through the filter.
  20   """
  21
  22   require HtmlSanitizeEx.Scrubber.Meta
  23   alias HtmlSanitizeEx.Scrubber.Meta
  24
  25   @valid_schemes ["http", "https"]
  26
  27   Meta.remove_cdata_sections_before_scrub()
  28   Meta.strip_comments()
  29
  30   # links
  31   Meta.allow_tag_with_uri_attributes("a", ["href"], @valid_schemes)
  32   Meta.allow_tag_with_these_attributes("a", ["name", "title"])
  33
  34   # paragraphs and linebreaks
  35   Meta.allow_tag_with_these_attributes("br", [])
  36   Meta.allow_tag_with_these_attributes("p", [])
  37
  38   # microformats
  39   Meta.allow_tag_with_these_attributes("span", [])
  40
  41   # allow inline images for custom emoji
  42   @markup Application.get_env(:pleroma, :markup)
  43   @allow_inline_images Keyword.get(@markup, :allow_inline_images)
  44
  45   if @allow_inline_images do
  46     Meta.allow_tag_with_uri_attributes("img", ["src"], @valid_schemes)
  47
  48     Meta.allow_tag_with_these_attributes("img", [
  49       "width",
  50       "height",
  51       "title",
  52       "alt"
  53     ])
  54   end
  55 end
  56
  57 defmodule Pleroma.HTML.Scrubber.Default do
  58   @doc "The default HTML scrubbing policy: no "
  59
  60   require HtmlSanitizeEx.Scrubber.Meta
  61   alias HtmlSanitizeEx.Scrubber.Meta
  62
  63   @valid_schemes ["http", "https"]
  64
  65   Meta.remove_cdata_sections_before_scrub()
  66   Meta.strip_comments()
  67
  68   Meta.allow_tag_with_uri_attributes("a", ["href"], @valid_schemes)
  69   Meta.allow_tag_with_these_attributes("a", ["name", "title"])
  70
  71   Meta.allow_tag_with_these_attributes("b", [])
  72   Meta.allow_tag_with_these_attributes("blockquote", [])
  73   Meta.allow_tag_with_these_attributes("br", [])
  74   Meta.allow_tag_with_these_attributes("code", [])
  75   Meta.allow_tag_with_these_attributes("del", [])
  76   Meta.allow_tag_with_these_attributes("em", [])
  77   Meta.allow_tag_with_these_attributes("i", [])
  78   Meta.allow_tag_with_these_attributes("li", [])
  79   Meta.allow_tag_with_these_attributes("ol", [])
  80   Meta.allow_tag_with_these_attributes("p", [])
  81   Meta.allow_tag_with_these_attributes("pre", [])
  82   Meta.allow_tag_with_these_attributes("span", [])
  83   Meta.allow_tag_with_these_attributes("strong", [])
  84   Meta.allow_tag_with_these_attributes("u", [])
  85   Meta.allow_tag_with_these_attributes("ul", [])
  86
  87   @markup Application.get_env(:pleroma, :markup)
  88   @allow_inline_images Keyword.get(@markup, :allow_inline_images)
  89
  90   if @allow_inline_images do
  91     Meta.allow_tag_with_uri_attributes("img", ["src"], @valid_schemes)
  92
  93     Meta.allow_tag_with_these_attributes("img", [
  94       "width",
  95       "height",
  96       "title",
  97       "alt"
  98     ])
  99   end
 100
 101   @allow_tables Keyword.get(@markup, :allow_tables)
 102
 103   if @allow_tables do
 104     Meta.allow_tag_with_these_attributes("table", [])
 105     Meta.allow_tag_with_these_attributes("tbody", [])
 106     Meta.allow_tag_with_these_attributes("td", [])
 107     Meta.allow_tag_with_these_attributes("th", [])
 108     Meta.allow_tag_with_these_attributes("thead", [])
 109     Meta.allow_tag_with_these_attributes("tr", [])
 110   end
 111
 112   @allow_headings Keyword.get(@markup, :allow_headings)
 113
 114   if @allow_headings do
 115     Meta.allow_tag_with_these_attributes("h1", [])
 116     Meta.allow_tag_with_these_attributes("h2", [])
 117     Meta.allow_tag_with_these_attributes("h3", [])
 118     Meta.allow_tag_with_these_attributes("h4", [])
 119     Meta.allow_tag_with_these_attributes("h5", [])
 120   end
 121
 122   @allow_fonts Keyword.get(@markup, :allow_fonts)
 123
 124   if @allow_fonts do
 125     Meta.allow_tag_with_these_attributes("font", ["face"])
 126   end
 127
 128   Meta.strip_everything_not_covered()
 129 end